TRW & Co · Funds & Financial Services
Payments and E-Money Lawyers in London
Payments lawyers London firms instruct advise payment institutions, e-money issuers, marketplaces and open banking providers on licensing, safeguarding, fraud and commercial contracts. With new FCA safeguarding rules in force since May 2026, the PSR moving into the FCA and the Treasury rewriting the payments framework, the right structure now shapes cost, growth and resilience.
Key pointPayment and e-money funds are not covered by the FSCS, so safeguarding is the customer's only protection on failure; the May 2026 rules make daily reconciliations, monthly reporting and a tested resolution pack non-negotiable.
At a glance
Two core regimes
The Payment Services Regulations 2017 and Electronic Money Regulations 2011 govern payment and e-money institutions, authorised and supervised by the FCA.
Small institution caps
Small payment institutions must keep monthly average transactions within 3 million euros; small EMIs must keep average outstanding e-money within 5 million euros.
Safeguarding since May
New FCA rules in force from 7 May 2026 require daily reconciliations, a monthly return, a resolution pack and, above £100,000, an annual audit.
APP fraud reimbursement
Since 7 October 2024, Faster Payments providers must reimburse in-scope APP fraud up to £85,000 per claim, split equally between sending and receiving firms.
Reform under way
The Financial Services and Markets Bill abolishes the PSR, and HM Treasury's July 2026 consultation proposes moving detailed payments rules to the FCA.
Swipe or scroll →
What payments and e-money law covers in England and Wales
Payments lawyers London businesses instruct advise anyone who moves, holds or issues money for others: payment institutions, electronic money issuers, card acquirers, remittance providers, open banking firms, marketplaces, payroll and expense platforms, and the banks and schemes that sit behind them. The work covers licensing, safeguarding, fraud, financial crime, scheme rules, outsourcing and the commercial contracts that hold a payments chain together.
The legal question starts when a business touches funds that belong to someone else. A marketplace that collects buyer payments before passing them to sellers, an app that initiates transfers from a customer's bank account, or a platform that issues stored value cards may each be providing a regulated payment service or issuing e-money. The answer decides whether the business needs FCA authorisation or registration, how it must protect customer funds, and what happens to those funds if it fails.
2026 is an unusually busy year. New safeguarding rules took effect in May, the Payment Systems Regulator is being folded into the FCA, the Treasury has consulted on rewriting the payment services framework, and stablecoins are moving into regulation. Good payments lawyers London firms rely on help clients plan for all of these at once rather than reacting to each in turn.
The legal and regulatory framework
Payments regulation in the UK sits largely outside the main FSMA authorisation regime, in two sets of regulations made originally to implement EU directives and retained after Brexit.
Payment Services Regulations 2017
The Payment Services Regulations 2017 (PSRs) govern payment services such as money remittance, executing payment transactions, issuing payment instruments, acquiring card transactions, payment initiation and account information services. They set out authorisation and registration requirements, capital and safeguarding obligations, and the conduct of business rules that apply to all payment service providers, including banks. Those conduct rules cover information requirements, execution times, liability for unauthorised transactions and strong customer authentication.
Electronic Money Regulations 2011
The Electronic Money Regulations 2011 (EMRs) govern the issuance of e-money, meaning monetary value stored electronically, issued on receipt of funds for making payment transactions and accepted by persons other than the issuer. Electronic money institutions (EMIs) can also provide payment services. E-money must be issued at par and redeemed at par on request, and interest cannot be paid on e-money holdings.
Regulators and payment systems
The FCA authorises and supervises payment and e-money institutions and is their supervisor under the Money Laundering Regulations 2017. The Payment Systems Regulator oversees designated payment systems, such as Faster Payments and the card schemes, under the Financial Services (Banking Reform) Act 2013. The Bank of England supervises systemically important payment systems and operates CHAPS. Pay.UK operates Faster Payments, Bacs and the cheque clearing system.
Funds held by payment and e-money institutions are not protected by the Financial Services Compensation Scheme. Safeguarding is the substitute, which is why it attracts so much regulatory attention.
Choosing the right licence or exclusion
The first decision for any payments business is which status it needs, if any, and it is the question payments lawyers London founders consult are asked most often. The table below compares the main routes. The thresholds shown come from the regulations themselves.
| Status | Typical business | Key condition | Main trade-off |
|---|---|---|---|
| Authorised payment institution (API) | Remittance, acquiring, payment accounts | Full authorisation, initial capital and own funds, safeguarding | Longest application; greatest flexibility and scale |
| Small payment institution (SPI) | Early-stage payment businesses | Monthly average payment transactions not exceeding 3 million euros over the preceding 12 months | Lighter capital requirements, but growth beyond the cap requires full authorisation |
| Authorised EMI | Wallets, prepaid cards, embedded accounts | Full authorisation, capital, safeguarding, redemption at par | Can issue e-money and provide payment services |
| Small EMI | Smaller e-money issuers | Average outstanding e-money not exceeding 5 million euros | Growth beyond the cap requires full authorisation |
| Registered account information service provider | Open banking data aggregation | Registration and professional indemnity cover | Cannot initiate payments or hold funds |
| Agent or distributor of an authorised firm | Brands embedding a licensed partner's services | Registration by the principal; principal remains responsible | Fast to market; dependent on the principal |
Exclusions also matter. Commercial agents, limited networks, and certain electronic communications and technical service providers can fall outside the regime, but each exclusion is narrow and some require notification to the FCA. Marketplaces in particular should not assume the commercial agent exclusion applies without careful structuring. Our EMI licence guide covers the application in more detail, and our FCA authorisation team handles applications across regimes.
Safeguarding: the new rules in force since May 2026
Safeguarding obligations sit in regulation 23 of the PSRs and regulation 20 of the EMRs. Firms must either segregate relevant funds in a designated safeguarding account or invest them in secure, liquid assets, or cover them with an insurance policy or comparable guarantee.
Following repeated failures of payment firms with large shortfalls in customer funds, the FCA introduced a supplementary safeguarding regime that came into force on 7 May 2026. Under the new rules, firms must:
- perform safeguarding reconciliations on each reconciliation day and resolve discrepancies promptly;
- submit a new monthly safeguarding return to the FCA;
- maintain a resolution pack that would enable an insolvency practitioner to return funds quickly; and
- obtain an annual safeguarding audit from a qualified auditor, unless the firm has not safeguarded more than £100,000 at any time over the relevant period.
The FCA has also signalled a later post-repeal regime, which would replace the current legislative framework with FCA rules once the Treasury's reforms take effect. Payments lawyers London firms consult should review governance, banking arrangements and outsourcing contracts against the new rules, not just the reconciliation process. See the FCA's announcement of the safeguarding changes.
Safeguarding failures are usually discovered at the worst moment, when a firm is already in difficulty and an administrator is trying to work out whose money is whose. A tested resolution pack, clean daily reconciliations and acknowledgement letters from safeguarding banks are what turn a disorderly failure into an orderly return of funds.
Fraud, APP reimbursement and liability
The PSRs allocate liability for unauthorised transactions between the provider and the customer, with strict limits on when a customer can be made to bear losses. Authorised push payment (APP) fraud is different: the customer authorises the payment, but has been deceived.
Since 7 October 2024, payment service providers sending and receiving Faster Payments must reimburse in-scope APP fraud victims up to £85,000 per claim, with the cost split equally between sending and receiving firms. The requirement was imposed by the PSR under section 54 of the 2013 Act, following the duty in section 72 of the Financial Services and Markets Act 2023. A parallel regime applies to CHAPS. Reimbursement can be refused in limited cases, including where the customer was grossly negligent, and that exception does not apply to vulnerable customers.
Payments lawyers London firms work with now treat fraud controls as a balance-sheet issue as well as a compliance one. The regime is under review, and receiving firms should expect closer scrutiny of mule account detection. Our article on APP fraud reimbursement sets out the rules, and the PSR's APP scams pages contain the policy statements.
In payments, the regulatory model and the commercial model are the same thing. Who holds the funds decides who needs the licence, who safeguards and who pays when fraud occurs.
Reform: PSR consolidation, a new payments framework and stablecoins
Three reform streams will reshape payments regulation over the next few years. Each requires firms to plan ahead rather than wait for final rules.
The PSR moving into the FCA
The government announced in 2025 that it would abolish the Payment Systems Regulator and transfer its functions to the FCA. The Financial Services and Markets Bill introduced in 2026 contains the provisions to do so, and gives the FCA new objectives and powers over payment systems. Until it commences, the PSR remains the regulator of designated systems, and its directions, including on APP reimbursement, continue to apply.
Modernising the payment services framework
On 14 July 2026 HM Treasury consulted on modernising payment services regulation. It proposes delegating more detailed requirements to FCA rules while keeping core matters, such as the perimeter and key customer rights, in legislation. It has committed to revoking the strong customer authentication provisions in the PSRs so the FCA can make more outcomes-based authentication rules. It also proposes a new right of access for variable recurring payments in open banking. Our article on smart data and open finance explains the wider data agenda.
Stablecoins and digital money
The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 make issuing a qualifying stablecoin in the UK a regulated activity from 25 October 2027. The Treasury's payments consultation separately proposes regulating the use of certain stablecoins for payments. Payments firms considering stablecoin settlement or wallets should map both regimes; see our crypto and digital assets practice.
How we run a payments authorisation or launch
A typical engagement for a new payments or e-money business, or a regulated firm adding a product, runs through the following stages.
- Business model and perimeter. Map flows of funds and data, identify each payment service or e-money activity, and test exclusions and agency options.
- Licensing strategy. Choose between full authorisation, small institution status, agency or a partner model, with a realistic timetable and budget.
- Application build. Prepare the business plan, financial projections, capital calculations, safeguarding, governance, AML, IT security and wind-down documentation.
- Banking and scheme access. Secure safeguarding and operational accounts, scheme memberships or sponsorship, and acknowledgement letters.
- Commercial contracts. Negotiate agreements with banks, card schemes, processors, programme managers, distributors and cloud providers.
- Customer documentation. Draft framework contracts, terms, fee disclosures and complaint processes compliant with the PSRs and the Consumer Duty.
- Go-live and supervision. Embed reporting, safeguarding reconciliations, fraud controls and change management, and respond to FCA queries as the firm scales.
Documents and evidence regulators expect
The FCA scrutinises payments applications closely and tests whether firms do what their documents say. Applicants and existing firms should be able to produce:
- a programme of operations and business plan with three years of projections and stress scenarios;
- capital and own funds calculations and evidence of initial capital;
- safeguarding policies, reconciliation procedures, acknowledgement letters and a resolution pack;
- AML and sanctions risk assessments, customer due diligence procedures and transaction monitoring rules;
- operational and security risk assessments, incident reporting procedures and outsourcing registers;
- a wind-down plan that shows how customer funds would be returned; and
- evidence of fitness and propriety and appropriate experience for directors and senior managers.
Risks and common mistakes
Mis-characterising the business model
Many platforms describe themselves as technology providers when, in substance, they hold or control customer funds. The FCA looks at the flow of funds and contractual rights, not marketing labels. If the platform receives money from payers before passing it to payees and has discretion over timing, it is likely to be providing a payment service. Getting this wrong can mean operating without authorisation, which is a criminal offence, and can damage relationships with banks and investors. A written perimeter analysis, reviewed when the flows change, protects the business and its funding round.
Treating safeguarding as a finance task only
Safeguarding sits with finance teams day to day, but it is a legal obligation with board-level accountability. The new rules require daily reconciliations, monthly reporting and an audited annual position, and the FCA expects senior managers to understand the arrangements. Common failures include commingling, poor record-keeping across multiple currencies, unclear treatment of funds in transit and missing acknowledgement letters. Weak arrangements become visible on insolvency, when customers may face shortfalls and delays. Boards should receive regular safeguarding reports and test the resolution pack.
Under-investing in financial crime controls
Payment and e-money firms are attractive to fraudsters and money launderers because they move money quickly. The FCA has repeatedly raised concerns about onboarding, transaction monitoring and mule accounts in this sector. Under APP reimbursement, receiving firms bear half the cost of in-scope fraud, so weak controls now have a direct financial consequence as well as a regulatory one. Firms should align their risk assessment with their actual customer base and corridors, and make sure monitoring keeps pace with growth. Our anti-money laundering team advises on these frameworks.
Weak agent and distributor oversight
Principals are responsible for their agents and distributors. Firms that grow quickly through partners sometimes register agents without adequate due diligence or ongoing monitoring, then find that the partner's conduct, marketing or customer outcomes attract regulatory attention. The principal remains accountable for complaints, safeguarding and financial crime controls across the network. Contracts should give the principal real audit, data and termination rights, and the compliance function needs resources to use them.
Ignoring data protection and outsourcing rules
Payments businesses process large volumes of personal and transaction data and rely heavily on cloud and processing partners. Outsourcing of important operational functions requires notice to the FCA and contracts that preserve the firm's control and the regulator's access. Data protection obligations under the UK GDPR apply alongside the PSRs, including for open banking data. Firms should keep a current outsourcing register and data map, and review contracts before a regulator or bank partner asks. Our data protection team works alongside the payments analysis.
Cross-border payments and the UK-Bangladesh corridor
Since Brexit, UK payment and e-money institutions no longer passport into the EU, and EU firms need UK authorisation to serve UK customers. Many groups now hold licences in both the UK and an EU member state, with intra-group arrangements to manage the split. Gulf and Singapore regulators each have their own payments regimes, so multi-jurisdiction products need a licence map before launch.
Remittance from the UK to Bangladesh is an important corridor. UK remittance providers must comply with UK safeguarding, AML and sanctions rules, while payout in Bangladesh involves Bangladesh Bank's foreign exchange framework and, for mobile wallet payout, the rules on mobile financial services. TRW & Co's Dhaka office can coordinate the Bangladesh side while our payments lawyers London team handles UK authorisation and contracts.
Where a payments dispute crosses borders, payments lawyers London counterparties instruct will look first at the contract chain. Governing law and dispute resolution clauses in scheme, banking and partner agreements become important. English law and London arbitration remain common choices for those contracts.
How TRW & Co's payments lawyers London clients instruct can help
We act for payment and e-money institutions, fintechs, marketplaces, banks and investors. Our work combines regulatory, commercial and disputes advice so the licence, the contracts and the risk allocation fit together.
Licensing and perimeter
Perimeter analyses, exclusion reviews and applications for API, SPI, EMI, small EMI and AISP status, including responses to FCA questions and variations as products change.
Safeguarding readiness
Gap analyses against the May 2026 rules, safeguarding policies, bank acknowledgement letters and resolution packs, and support during audits and FCA reviews.
Fraud and financial crime
APP reimbursement processes, mule account controls, AML and sanctions frameworks, and responses to supervisory concerns. Where enforcement follows, we act in the investigation.
Commercial contracts
Banking, scheme, processing, programme management, agency and distribution agreements, with clear allocation of regulatory responsibilities, data and liability.
Transactions and investment
Regulatory due diligence, change in control approvals and transaction documents for acquisitions of and investments in payments businesses, alongside our fintech practice.
Disputes and insolvency
Disputes with banks, schemes and partners, customer complaints and Ombudsman referrals, and advice on special administration and safeguarding shortfalls.
See our practices for related areas, or contact us to discuss a licence, a launch or a regulatory concern.
Checklist for decision-makers
Founders, boards and investors can use these questions to test a payments business. Payments lawyers London investors trust will usually ask the same questions in due diligence.
- Have we documented why our business model does, or does not, require authorisation or registration?
- Are we within any small institution thresholds, and do we know when we will outgrow them?
- Do our safeguarding arrangements meet the rules in force since 7 May 2026, including reconciliations, the monthly return, the resolution pack and audit?
- Can we evidence effective APP fraud controls as both a sending and receiving firm?
- Are agents, distributors and outsourced providers covered by contracts that give us real oversight?
- Have we planned for PSR consolidation, the Treasury's payments reforms and any stablecoin strategy?
- Do we have a licence and governing law map for every country in which we operate?
Getting these answers right early is cheaper than remediation after a supervisory visit or a bank partner's review, and it supports valuation when the business raises capital or is sold.
Frequently asked questions
01Do I need an EMI licence or a payment institution licence?
It depends on whether you issue e-money. If customers load funds that are stored as electronic value and used for future payments, such as a wallet or prepaid card, you are likely to need EMI status. If you only execute or remit payments without storing value, payment institution status may suffice. Small institution routes exist for lower volumes. Some businesses can operate as an agent or distributor of a licensed firm instead. A perimeter analysis of your flow of funds should come first.
02How long does FCA authorisation take for a payments firm?
Timelines vary with the quality of the application and the complexity of the model. The FCA must determine complete applications within statutory periods, but the clock effectively restarts if it asks for information the application should have contained. In practice, well-prepared applications with clear safeguarding, AML, governance and wind-down arrangements move faster. Firms should also allow time to secure safeguarding bank accounts and scheme access, which are often the real bottleneck.
03What changed in the safeguarding rules in 2026?
From 7 May 2026, payment and e-money institutions must perform safeguarding reconciliations each reconciliation day, submit a monthly safeguarding return to the FCA, maintain a resolution pack to help return funds on insolvency, and obtain an annual safeguarding audit from a qualified auditor unless they have not safeguarded more than £100,000 in the relevant period. The FCA has also signalled a later regime replacing the current legislation with FCA rules.
04Are payment and e-money funds protected by the FSCS?
No. Funds held by payment institutions and EMIs are not covered by the Financial Services Compensation Scheme. Instead, firms must safeguard customer funds by segregating them or protecting them with insurance or a guarantee. If a firm fails, customers are paid from the safeguarded pool through an insolvency process, and shortfalls or delays can occur where safeguarding was weak. That is why the FCA has tightened the rules and why customers and partners increasingly ask about safeguarding arrangements.
05Who pays when a customer is tricked into sending money to a fraudster?
For in-scope Faster Payments and CHAPS transfers, the sending firm must normally reimburse the victim up to £85,000 per claim, and can recover half from the receiving firm. Reimbursement can be refused in limited cases, such as first-party fraud or gross negligence by the customer, but not on gross negligence grounds where the customer is vulnerable. Transfers on other rails, such as card payments or international transfers, fall outside the mandatory scheme, though general PSR and Ombudsman principles still apply.
06What happens to the Payment Systems Regulator?
The government decided to abolish the PSR and transfer its functions to the FCA. The Financial Services and Markets Bill introduced in 2026 contains the legislation and gives the FCA new objectives and powers over payment systems. Until those provisions commence, the PSR continues to regulate designated payment systems, and its directions, including the APP reimbursement requirement, remain in force. Firms should expect continuity of substance, with the FCA becoming a single point of contact.
07Can a Bangladeshi or overseas payments company serve UK customers?
Only with the right UK status. An overseas firm providing payment services or issuing e-money to UK customers generally needs FCA authorisation or registration, or must operate through a UK-licensed partner as agent or distributor. Marketing to UK consumers can also trigger financial promotion and consumer protection rules. For remittance into Bangladesh, the payout side must comply with Bangladesh Bank requirements. We coordinate both sides with our Dhaka office.
Sources and official materials
- Payment Services Regulations 2017 — Authorisation, safeguarding and conduct rules for payment services
- Electronic Money Regulations 2011 — Regime for e-money issuers
- FCA: changes to payment safeguarding rules — Supplementary safeguarding regime from May 2026
- Payment Systems Regulator: APP scams — APP fraud reimbursement policy and directions
- Financial Services and Markets Act 2023, section 72 — Statutory basis for APP reimbursement
- Financial Services (Banking Reform) Act 2013 — Regulation of payment systems
- FCA: apply to become an e-money or payment institution — Application guidance for payments firms
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.